jdx/mise · error

relay options require --github-relay-read-only

Error message

relay options require --github-relay-read-only

What it means

GitHubRelay::configure validates that relay observability options (--github-relay-log-requests, --github-relay-no-log-requests, --github-relay-log-format, --github-relay-max-duration) are only accepted when the relay is enabled. When scope is None (relay off) but any of these options was supplied, it bails instead of ignoring them.

Source

Thrown at src/github_relay.rs:86

            jsonl: false,
            max_duration: std::time::Duration::ZERO,
            request_timeout: std::time::Duration::from_secs(300),
            concurrency: 8,
        }
    }
}

/// Resolve observability and limits only after explicit access authorization.
pub(crate) fn configure(
    scope: Option<Scope>,
    log_requests: bool,
    no_log_requests: bool,
    format: Option<&str>,
    max_duration: Option<&str>,
) -> Result<Option<Scope>> {
    let Some(scope) = scope else {
        if log_requests || no_log_requests || format.is_some() || max_duration.is_some() {
            bail!("relay options require --github-relay-read-only");
        }
        return Ok(None);
    };
    let settings = crate::config::Settings::get();
    let settings = &settings.github_relay;
    let format = format.unwrap_or(&settings.log_format);
    if !matches!(format, "text" | "jsonl") {
        bail!("relay log format must be text or jsonl");
    }
    let timeout = duration::parse_duration(&settings.request_timeout)?;
    if timeout.is_zero() {
        bail!("relay request timeout must be greater than zero");
    }
    if !(1..=32).contains(&settings.concurrency) {
        bail!("relay concurrency must be between 1 and 32");
    }
    let max_duration = duration::parse_duration(max_duration.unwrap_or(&settings.max_duration))?;
    if std::time::Instant::now().checked_add(timeout).is_none()

View on GitHub (pinned to afd2eddd3a)

Solutions

  1. Enable the relay by adding --github-relay-read-only (and the repo scope flags) so the options apply.
  2. Remove the relay log options when the relay is disabled.
  3. Move relay/log configuration into mise.toml under [github_relay] where it is validated together with the enabled flag.

Example fix

// before
mise --github-relay-log-requests exec -- npm install
// after
mise --github-relay-read-only --github-relay-repo owner/repo --github-relay-log-requests exec -- npm install
Defensive patterns

Strategy: validation

Validate before calling

# shell: only pass log flags when relay enabled
flags=""
if $RELAY_ENABLED; then flags="$flags --github-relay-log-requests"; fi

Type guard

fn relay_options_allowed(scope: &Option<Scope>, log: bool, fmt: Option<&str>, dur: Option<&str>) -> bool {
    scope.is_some() || !(log || fmt.is_some() || dur.is_some())
}

Try / catch

match configure(scope, log_requests, no_log_requests, format, max_duration) {
    Err(e) if e.to_string().contains("require --github-relay-read-only") => {
        // re-invoke with the relay enabled or the log flags removed
    }
    r => r,
}

Prevention

When it happens

Trigger: configure is called (from npm_command or cli_observability_overrides) with scope=None while log_requests, no_log_requests, format, or max_duration is Some/true — e.g. `mise --github-relay-log-requests exec ...` without --github-relay-read-only.

Common situations: Global mise arguments like log-format flags set in an alias while the relay is disabled in this project; scripts passing relay flags unconditionally; documentation examples that omit the enable flag.

Understand the failure class

Background: "--flag is required" and "must specify" CLI errors: how missing-required-flag validation works and how to fix it — this error's family across 20 libraries.

Related errors

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/f65b12a53598b2f0. Report an issue: GitHub.